diff --git a/.hadolint.yaml b/.hadolint.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..5c95da2e837f52e44e9d18cd321bbfe885a18d14
--- /dev/null
+++ b/.hadolint.yaml
@@ -0,0 +1,3 @@
+ignored:
+  - DL3003
+  - DL3018
diff --git a/latest.Dockerfile b/latest.Dockerfile
index a5b666c040c6610098017df074c15428fd587ea4..e2a458c6a94c52de75430ae21a362a735049b7f0 100644
--- a/latest.Dockerfile
+++ b/latest.Dockerfile
@@ -1,7 +1,7 @@
 ARG GHC_VERSION_BUILD
 ARG CABAL_VERSION_BUILD
 
-FROM glcr.b-data.ch/ghc/ghc-musl:9.4.5 as bootstrap
+FROM glcr.b-data.ch/ghc/ghc-musl:9.4.6 as bootstrap
 
 ARG GHC_VERSION_BUILD
 ARG CABAL_VERSION_BUILD
@@ -29,13 +29,13 @@ RUN apk upgrade --no-cache \
     zlib-dev
 
 RUN cd /tmp \
-  && curl -sSLO https://downloads.haskell.org/~ghc/$GHC_VERSION/ghc-$GHC_VERSION-src.tar.xz \
-  && curl -sSLO https://downloads.haskell.org/~ghc/$GHC_VERSION/ghc-$GHC_VERSION-src.tar.xz.sig \
+  && curl -sSLO https://downloads.haskell.org/~ghc/"$GHC_VERSION"/ghc-"$GHC_VERSION"-src.tar.xz \
+  && curl -sSLO https://downloads.haskell.org/~ghc/"$GHC_VERSION"/ghc-"$GHC_VERSION"-src.tar.xz.sig \
   && gpg --keyserver hkps://keyserver.ubuntu.com:443 \
     --receive-keys FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD \
-  && gpg --verify ghc-$GHC_VERSION-src.tar.xz.sig ghc-$GHC_VERSION-src.tar.xz \
-  && tar xf ghc-$GHC_VERSION-src.tar.xz \
-  && cd ghc-$GHC_VERSION \
+  && gpg --verify "ghc-$GHC_VERSION-src.tar.xz.sig" "ghc-$GHC_VERSION-src.tar.xz" \
+  && tar -xJf "ghc-$GHC_VERSION-src.tar.xz" \
+  && cd "ghc-$GHC_VERSION" \
   && ./boot.source \
   && ./configure --disable-ld-override LD=ld.gold \
   # Use the LLVM backend
@@ -46,11 +46,11 @@ RUN cd /tmp \
   && sed -i -e 's/unknown-linux-gnu/alpine-linux/g' llvm-targets \
   && cabal update \
   # See https://unix.stackexchange.com/questions/519092/what-is-the-logic-of-using-nproc-1-in-make-command
-  && hadrian/build binary-dist -j$((`nproc`+1)) \
+  && hadrian/build binary-dist -j"$(($(nproc)+1))" \
     --flavour=perf+llvm+split_sections \
     --docs=none \
   # See https://gitlab.haskell.org/ghc/ghc/-/wikis/commentary/libraries/version-history
-  && cabal install --allow-newer --constraint 'Cabal-syntax<3.11' cabal-install-$CABAL_VERSION
+  && cabal install --allow-newer --constraint 'Cabal-syntax<3.11' "cabal-install-$CABAL_VERSION"
 
 FROM alpine:3.18 as builder
 
@@ -98,12 +98,12 @@ RUN apk upgrade --no-cache \
     zlib-dev \
     zlib-static
 
-COPY --from=bootstrap /tmp/ghc-$GHC_VERSION/_build/bindist/ghc-$GHC_VERSION-*-alpine-linux.tar.xz /tmp/
+COPY --from=bootstrap /tmp/ghc-"$GHC_VERSION"/_build/bindist/ghc-"$GHC_VERSION"-*-alpine-linux.tar.xz /tmp/
 COPY --from=bootstrap /root/.cabal/bin/cabal /usr/bin/cabal
 
 RUN cd /tmp \
-  && tar -xJf ghc-$GHC_VERSION-*-alpine-linux.tar.xz \
-  && cd ghc-$GHC_VERSION-*-alpine-linux \
+  && tar -xJf ghc-"$GHC_VERSION"-*-alpine-linux.tar.xz \
+  && cd ghc-"$GHC_VERSION"-*-alpine-linux \
   && ./configure --disable-ld-override \
   && make install \
   && cd / \
@@ -111,6 +111,8 @@ RUN cd /tmp \
 
 FROM builder as tester
 
+WORKDIR /usr/local/src
+
 COPY Main.hs Main.hs
 
 RUN ghc -static -optl-pthread -optl-static Main.hs \